{
  "@id": "urn:uuid:c48938aa-0f5a-4cad-883b-45f567b9cc4f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:07:00.085664+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.29-p2+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unsafe deserialization of X-XSRF-TOKEN cookie values. The target repository (Laravel 10.48.29) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unserialized cookie decryption) does not exist in this version - all cookie encryption/decryption operations explicitly disable serialization by default (static::$serialize = false), preventing the unserialize() attack vector entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unsafe deserialization of X-XSRF-TOKEN cookie values. The target repository (Laravel 10.48.29) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unserialized cookie decryption) does not exist in this version - all cookie encryption/decryption operations explicitly disable serialization by default (static::$serialize = false), preventing the unserialize() attack vector entirely."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.29-p2+tuxcare of laravel/framework. CVE-2020-19316 is not present in this target. The OS command injection vulnerability in the Filesystem::link() method was fixed in upstream Laravel 5.8.17 (May 2019) by adding escapeshellarg() to both $target and $link parameters. The target version (10.48.29) is from years later and already includes this fix. TuxCare onboarded version 10.48.29 in July 2026 via snapshot commit a11ca48cf7, which already contained the fix from the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "CVE-2020-19316 is not present in this target. The OS command injection vulnerability in the Filesystem::link() method was fixed in upstream Laravel 5.8.17 (May 2019) by adding escapeshellarg() to both $target and $link parameters. The target version (10.48.29) is from years later and already includes this fix. TuxCare onboarded version 10.48.29 in July 2026 via snapshot commit a11ca48cf7, which already contained the fix from the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:35.131174+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.29-p2+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel Framework v10.48.29. The vulnerability involved bypassing the $guarded property using non-existent column names (including JSON nesting expressions). The fix adds isGuardableColumn() validation that treats non-existent columns as guarded. This fix was introduced upstream by Taylor Otwell in August 2020 (commit 897d107775) and has been present in all Laravel versions since then. The target version 10.48.29, released in 2024, shipped with this fix already integrated into the upstream codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "CVE-2020-24941 does not affect Laravel Framework v10.48.29. The vulnerability involved bypassing the $guarded property using non-existent column names (including JSON nesting expressions). The fix adds isGuardableColumn() validation that treats non-existent columns as guarded. This fix was introduced upstream by Taylor Otwell in August 2020 (commit 897d107775) and has been present in all Laravel versions since then. The target version 10.48.29, released in 2024, shipped with this fix already integrated into the upstream codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:49.287382+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.29-p2+tuxcare of laravel/framework. The target Laravel framework v10.48.29 is not affected by CVE-2021-21263. The vulnerability involves query binding exploitation where array values passed to query builder methods lead to unexpected query bindings. The fix, which limits array inputs using the `flattenValue()` helper method, was already present in the upstream Laravel v10.48.29 release that TuxCare onboarded. All nine vulnerable methods identified in the upstream patch (`where`, `whereBetween`, `whereDate`, `whereTime`, `whereDay`, `whereMonth`, `whereYear`, `whereJsonLength`, `having`) have equivalent or superior protections in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "impact_statement": "The target Laravel framework v10.48.29 is not affected by CVE-2021-21263. The vulnerability involves query binding exploitation where array values passed to query builder methods lead to unexpected query bindings. The fix, which limits array inputs using the `flattenValue()` helper method, was already present in the upstream Laravel v10.48.29 release that TuxCare onboarded. All nine vulnerable methods identified in the upstream patch (`where`, `whereBetween`, `whereDate`, `whereTime`, `whereDay`, `whereMonth`, `whereYear`, `whereJsonLength`, `having`) have equivalent or superior protections in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:25:11.687376+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43808"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.29-p2+tuxcare of laravel/framework. The target Laravel framework version 10.48.29-p2+tuxcare is not affected by CVE-2024-52301. The vulnerable pattern (using $_SERVER['argv'] without checking if running in console mode) is not present in the target code. The fix was already included in the upstream Laravel 10.48.29 release that TuxCare onboarded. The detectEnvironment() method at src/Illuminate/Foundation/Application.php:720-727 properly checks $this->runningInConsole() before using $_SERVER['argv'], preventing environment manipulation via query strings when register_argc_argv is enabled.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52301"
      },
      "impact_statement": "The target Laravel framework version 10.48.29-p2+tuxcare is not affected by CVE-2024-52301. The vulnerable pattern (using $_SERVER['argv'] without checking if running in console mode) is not present in the target code. The fix was already included in the upstream Laravel 10.48.29 release that TuxCare onboarded. The detectEnvironment() method at src/Illuminate/Foundation/Application.php:720-727 properly checks $this->runningInConsole() before using $_SERVER['argv'], preventing environment manipulation via query strings when register_argc_argv is enabled."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:05:48.947173+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-27515"
      },
      "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T12:26:34.355968+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T12:26:43.737844+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.48.29-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:07:00.085664+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target is laravel/framework 10.48.29, which has no Illuminate\\Concurrency component. Concurrency::run(), the ProcessDriver and the hidden child-process command that parses the serialized, compressed result from the child's stdout were introduced in 11.x. The CVE fixes are 12.71.0 and 13.40.0. Nothing in the 10.x tree receives a child task's stdout and deserializes it as a trusted result.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 The target is laravel/framework 10.48.29, which has no Illuminate\\Concurrency component. Concurrency::run(), the ProcessDriver and the hidden child-process command that parses the serialized, compressed result from the child's stdout were introduced in 11.x. The CVE fixes are 12.71.0 and 13.40.0. Nothing in the 10.x tree receives a child task's stdout and deserializes it as a trusted result."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:46:09.826489+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      },
      "impact_statement": "not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T12:26:34.355968+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.29-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:00:11.359241+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T12:26:34.355968+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:13:18.978013+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "impact_statement": "not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:18:00.235397+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.29-p2+tuxcare of laravel/framework. Target Laravel framework version 10.48.29-p2+tuxcare is not affected by GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (using predictable sha1() hash for cookie prefix validation) is not present. The target uses hash_hmac() with the encryption key, which is the fixed version. This fix was shipped in upstream Laravel v10.48.29 before TuxCare onboarded the version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "Target Laravel framework version 10.48.29-p2+tuxcare is not affected by GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (using predictable sha1() hash for cookie prefix validation) is not present. The target uses hash_hmac() with the encryption key, which is the fixed version. This fix was shipped in upstream Laravel v10.48.29 before TuxCare onboarded the version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "impact_statement": "not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:49.287227+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.29-p2+tuxcare of laravel/framework. The target Laravel framework 10.48.29 is NOT affected by GHSA-x7p5-p2c9-phvg. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) are protected with the flattenValue() defense that normalizes array inputs to scalar values, exactly matching the upstream security patches from January 2021. The fix was already present in the upstream Laravel 10.48.29 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      },
      "impact_statement": "The target Laravel framework 10.48.29 is NOT affected by GHSA-x7p5-p2c9-phvg. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) are protected with the flattenValue() defense that normalizes array inputs to scalar values, exactly matching the upstream security patches from January 2021. The fix was already present in the upstream Laravel 10.48.29 release that TuxCare onboarded."
    }
  ]
}